a23602583b1c9700f9dc098b4b8fa70a29b59356f3d92e1550b0e10a258e8fde

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe
Size

168KB
MD5

f973b94b171c96235f2f3c538dfd151a
SHA1

34a84f2d123c99a963e4eb47496299d5d15c3c1b
SHA256

a23602583b1c9700f9dc098b4b8fa70a29b59356f3d92e1550b0e10a258e8fde
SHA512

56026005cb2c0630b3ecb06a328b6be142ec2ce83e3b8b55ba845e0a53f3c9493123636500f78344ef6ad5429829f000653d64a1a97bcd6bd169e34d0ee20d9b
SSDEEP

1536:1EGh0o7lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o7lqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012253-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122c5-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012253-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}	{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}\stubpath = "C:\\Windows\\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}.exe"	{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7888A355-9460-4ec8-80D9-03882684AA12}	{40AB139A-314C-49e4-854E-98969DF47776}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7888A355-9460-4ec8-80D9-03882684AA12}\stubpath = "C:\\Windows\\{7888A355-9460-4ec8-80D9-03882684AA12}.exe"	{40AB139A-314C-49e4-854E-98969DF47776}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1AC1499E-D251-4918-B294-9677FA956C9E}	{7888A355-9460-4ec8-80D9-03882684AA12}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}\stubpath = "C:\\Windows\\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe"	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{67FACD5B-05B7-42e4-A6CF-24594232BD65}\stubpath = "C:\\Windows\\{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe"	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40AB139A-314C-49e4-854E-98969DF47776}	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{67FACD5B-05B7-42e4-A6CF-24594232BD65}	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}\stubpath = "C:\\Windows\\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe"	{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}\stubpath = "C:\\Windows\\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe"	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}	{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}\stubpath = "C:\\Windows\\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe"	{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}	{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{40AB139A-314C-49e4-854E-98969DF47776}\stubpath = "C:\\Windows\\{40AB139A-314C-49e4-854E-98969DF47776}.exe"	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1AC1499E-D251-4918-B294-9677FA956C9E}\stubpath = "C:\\Windows\\{1AC1499E-D251-4918-B294-9677FA956C9E}.exe"	{7888A355-9460-4ec8-80D9-03882684AA12}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}\stubpath = "C:\\Windows\\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe"	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}\stubpath = "C:\\Windows\\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe"	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe

Deletes itself 1 IoCs

pid	Process
2356	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe
3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe
2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe
3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe
1820	{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
1972	{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
3024	{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe
1484	{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}.exe	{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe
File created	C:\Windows\{7888A355-9460-4ec8-80D9-03882684AA12}.exe	{40AB139A-314C-49e4-854E-98969DF47776}.exe
File created	C:\Windows\{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
File created	C:\Windows\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe
File created	C:\Windows\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe	{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
File created	C:\Windows\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
File created	C:\Windows\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe	{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
File created	C:\Windows\{40AB139A-314C-49e4-854E-98969DF47776}.exe	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe
File created	C:\Windows\{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	{7888A355-9460-4ec8-80D9-03882684AA12}.exe
File created	C:\Windows\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
File created	C:\Windows\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe
Token: SeIncBasePriorityPrivilege	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe
Token: SeIncBasePriorityPrivilege	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
Token: SeIncBasePriorityPrivilege	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe
Token: SeIncBasePriorityPrivilege	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
Token: SeIncBasePriorityPrivilege	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
Token: SeIncBasePriorityPrivilege	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe
Token: SeIncBasePriorityPrivilege	1820	{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
Token: SeIncBasePriorityPrivilege	1972	{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
Token: SeIncBasePriorityPrivilege	3024	{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2692	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	28
PID 2996 wrote to memory of 2692	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	28
PID 2996 wrote to memory of 2692	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	28
PID 2996 wrote to memory of 2692	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	28
PID 2996 wrote to memory of 2356	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	29
PID 2996 wrote to memory of 2356	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	29
PID 2996 wrote to memory of 2356	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	29
PID 2996 wrote to memory of 2356	2996	2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe	29
PID 2692 wrote to memory of 3008	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	30
PID 2692 wrote to memory of 3008	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	30
PID 2692 wrote to memory of 3008	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	30
PID 2692 wrote to memory of 3008	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	30
PID 2692 wrote to memory of 2604	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	31
PID 2692 wrote to memory of 2604	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	31
PID 2692 wrote to memory of 2604	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	31
PID 2692 wrote to memory of 2604	2692	{40AB139A-314C-49e4-854E-98969DF47776}.exe	31
PID 3008 wrote to memory of 2620	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	32
PID 3008 wrote to memory of 2620	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	32
PID 3008 wrote to memory of 2620	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	32
PID 3008 wrote to memory of 2620	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	32
PID 3008 wrote to memory of 2768	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	33
PID 3008 wrote to memory of 2768	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	33
PID 3008 wrote to memory of 2768	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	33
PID 3008 wrote to memory of 2768	3008	{7888A355-9460-4ec8-80D9-03882684AA12}.exe	33
PID 2620 wrote to memory of 2036	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	36
PID 2620 wrote to memory of 2036	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	36
PID 2620 wrote to memory of 2036	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	36
PID 2620 wrote to memory of 2036	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	36
PID 2620 wrote to memory of 2860	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	37
PID 2620 wrote to memory of 2860	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	37
PID 2620 wrote to memory of 2860	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	37
PID 2620 wrote to memory of 2860	2620	{1AC1499E-D251-4918-B294-9677FA956C9E}.exe	37
PID 2036 wrote to memory of 3064	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	38
PID 2036 wrote to memory of 3064	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	38
PID 2036 wrote to memory of 3064	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	38
PID 2036 wrote to memory of 3064	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	38
PID 2036 wrote to memory of 1992	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	39
PID 2036 wrote to memory of 1992	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	39
PID 2036 wrote to memory of 1992	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	39
PID 2036 wrote to memory of 1992	2036	{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe	39
PID 3064 wrote to memory of 1264	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	40
PID 3064 wrote to memory of 1264	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	40
PID 3064 wrote to memory of 1264	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	40
PID 3064 wrote to memory of 1264	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	40
PID 3064 wrote to memory of 2188	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	41
PID 3064 wrote to memory of 2188	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	41
PID 3064 wrote to memory of 2188	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	41
PID 3064 wrote to memory of 2188	3064	{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe	41
PID 1264 wrote to memory of 288	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	42
PID 1264 wrote to memory of 288	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	42
PID 1264 wrote to memory of 288	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	42
PID 1264 wrote to memory of 288	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	42
PID 1264 wrote to memory of 856	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	43
PID 1264 wrote to memory of 856	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	43
PID 1264 wrote to memory of 856	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	43
PID 1264 wrote to memory of 856	1264	{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe	43
PID 288 wrote to memory of 1820	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	44
PID 288 wrote to memory of 1820	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	44
PID 288 wrote to memory of 1820	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	44
PID 288 wrote to memory of 1820	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	44
PID 288 wrote to memory of 2568	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	45
PID 288 wrote to memory of 2568	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	45
PID 288 wrote to memory of 2568	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	45
PID 288 wrote to memory of 2568	288	{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_f973b94b171c96235f2f3c538dfd151a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\{40AB139A-314C-49e4-854E-98969DF47776}.exe
  C:\Windows\{40AB139A-314C-49e4-854E-98969DF47776}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\{7888A355-9460-4ec8-80D9-03882684AA12}.exe
    C:\Windows\{7888A355-9460-4ec8-80D9-03882684AA12}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
      C:\Windows\{1AC1499E-D251-4918-B294-9677FA956C9E}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe
        
        C:\Windows\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Windows\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
        
        C:\Windows\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
        
        C:\Windows\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe
        
        C:\Windows\{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:288
        
        C:\Windows\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
        
        C:\Windows\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Windows\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
        
        C:\Windows\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
        
        C:\Windows\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe
        
        C:\Windows\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}.exe
        
        C:\Windows\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}.exe
        12⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6AFFD~1.EXE > nul
        12⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{605CD~1.EXE > nul
        11⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05CC5~1.EXE > nul
        10⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{67FAC~1.EXE > nul
        9⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8A2AD~1.EXE > nul
        8⤵
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28F8F~1.EXE > nul
        7⤵
        
        PID:2188
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{72020~1.EXE > nul
        6⤵
        
        PID:1992
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1AC14~1.EXE > nul
        5⤵
        
        PID:2860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{7888A~1.EXE > nul
      4⤵
      PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{40AB1~1.EXE > nul
    3⤵
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05CC5C46-5DC6-4be3-A682-601B6D8B1B1B}.exe

Filesize
168KB

MD5
083934f10cd04a4188d3521c1bfaf0c4

SHA1
29435cd041752082e7e0e3efeeda7e8b3ec0b6c0

SHA256
f7b17d177fa0b2f394444edc9f3f037964a4a60655646d25b0320e72be3fe067

SHA512
0eb6979777477e7369199a5e1eecb2c6ecfd279ce83bb7909c8355b28fbf1f0c53493d5e5c880ccffd7c2e2ca9e3c4e1929311105176a143d8fae1abcdc216cc

Download Submit
C:\Windows\{1AC1499E-D251-4918-B294-9677FA956C9E}.exe

Filesize
168KB

MD5
50db888e9c0bac87749983b1623ccbd1

SHA1
93a86d32d6abd21a6a971f997e46fe6917aea551

SHA256
dff4b9fa4ff25f90f19e2ca9b8d9e8be12e248ee4995eb3bc1df9d7a6853a324

SHA512
46472980bb5ce2bf5b736554aaf3eace31e5248df77001789639198bd18f07d936e098a3c88c01d37dd62a1f95b4616d9baf085e450380c388c35c76ddf6de82

Download Submit
C:\Windows\{28F8FAB1-33C2-40ca-95C8-880F4505F7AD}.exe

Filesize
168KB

MD5
8726a9188edd98cb2529a3047cdd6c42

SHA1
55bce8cc97e38dc447e2f1f5cc6518d41169b6b1

SHA256
c8d264e181c5cc0bfe54ad91b94cf175e78b3663189cc21a29ac0a424d0d5342

SHA512
c1c92db361be38a10157e5cf1a12adf83495eacfb4ec9e59b094d33e09354c9a58b8c6ac5a7026dc87024d7a291d1985f44d10b5b235c88a1b4fc2346406f2bf

Download Submit
C:\Windows\{2D9C03E7-BDB7-4700-BD73-7CB6DA44214B}.exe

Filesize
168KB

MD5
6886829beff823faf163f4ef6b6b94c4

SHA1
687f2962216918eba82ea271354fec5cfbc82a2f

SHA256
f930e11b4115dca4c2dca9c9f3da9e6bdbee0b69ba01de97801849f4ca943740

SHA512
6a1e0ca9ff8871dd55bf113d7e6a06d59a462466d269510eed66aa139de4410839253372cde01384a52e6f2881dd61346181361f4def58e8e5dc50b49713455a

Download Submit
C:\Windows\{40AB139A-314C-49e4-854E-98969DF47776}.exe

Filesize
168KB

MD5
7c9346080f85a4825df10f6733ff8235

SHA1
8b1e5f21e673edd30ec3d176d4f9bc85244eac3d

SHA256
d04d11f82d1ed25e195943aaf83d4af5fe86d9b85d818a737ca8ab65d97c03ec

SHA512
5b7a02ea9542b52d72a9d6172baa112ccf8691d21e271631a025bd512a68596f4aa2c6ca97a72de286fd32f0edab817a4e63e166f05de5b2233e41bfd50a0fe7

Download Submit
C:\Windows\{605CDE9F-08E6-4fb8-BA84-0991D58AC859}.exe

Filesize
168KB

MD5
23146b03d4818e3fdf5baba2c9872cd5

SHA1
c1b1b9654a5d26341f7e29ddee3fd9f29b284f37

SHA256
9e74e6dc3e1063c85d45316a8d3d301d5fa3a7f38e622676fc3ff975c0859892

SHA512
06583020f4ec348be1659d65f2a057b0d0447f4667cc58762639f40b5d90a0b463c6242c96cff41304d177d289ea5c8df30d5594c04df80b3ab20dc62192acb1

Download Submit
C:\Windows\{67FACD5B-05B7-42e4-A6CF-24594232BD65}.exe

Filesize
168KB

MD5
20e95da790de68ac342c96bd46ac72a5

SHA1
b6343c916197d2344dc8037aa61aa3fd7aad6add

SHA256
b8da73ce9a449c254350c3bc8fb358e77c575a108c6d574b7ac7626a5915c7aa

SHA512
2b8a9357a0a6334aedcf02715281931e9b6f1a48ec143a6123f08115166fd28efe1034dc37b79dd37f2ed500ce5faadc7aee05b2ec343c4f1f2626b5337026fb

Download Submit
C:\Windows\{6AFFD4EF-4DED-46a2-A585-68E37434CB04}.exe

Filesize
168KB

MD5
e744e0d4167b893ea6b27bbb867f7eab

SHA1
58c3359819fd497038ef15b84b20c56a5450d202

SHA256
c8c5c9a0f120d7b0076f7cbe72de899e058bba18872fa8446f8080ad8dec7d81

SHA512
d737a630d20949926ab8465e7619cd2efb6bc29cd6cdb6f949423c5271c31b7a7e572e8c1c4ac5501226165d2b50f04bf44887dd6e547d012c386138d614968f

Download Submit
C:\Windows\{72020C22-6A6E-4095-AC80-B20CA92FF1B5}.exe

Filesize
168KB

MD5
05627aa416144c7dd4cee9c2cb30fd26

SHA1
23c4b10f8520d2d205b05b038ea0465f68175d3d

SHA256
093aa3c4519bf6b434a295110a3892a8fa95517a65b25689f97d9188544f7fc9

SHA512
66817c5afaf54e9b79d3e97ca3508928785dac8d478a644911f580e24754db01af3e4d462a63f7cfb54940c3470b665b5671081e23e7de4fa68dac53e4bd7699

Download Submit
C:\Windows\{7888A355-9460-4ec8-80D9-03882684AA12}.exe

Filesize
168KB

MD5
c5f0570d28c7ff3fb5b6946bc8edb256

SHA1
10ee5b875bb36374e5f8e920f633b20f58a60527

SHA256
90bcac18a6cc7a129b53df3101ab6fb21490aa0d59b6c070002ee5554b22b001

SHA512
ac7f164dcda7f80a30b683417ea6683679fc851add828c872ac5f9d193eb19f2870b8f830976331b686375456729bf172018f7b025f5be880df719869fc46356

Download Submit
C:\Windows\{8A2AD001-1B91-4c71-A1DD-5CFEE81CEBED}.exe

Filesize
168KB

MD5
53a440a42e1762776fb28ccadccf355e

SHA1
ad3bdcb5c455b8f3f091e5ce86217f8e7dcc7745

SHA256
31b5b2940265cd0b504c48402cfc59d62b0c6607c0da7c94f91bb9f46d0808b0

SHA512
b6ea6d2f6b50748b1928bb5b826e26fa052a0b007ac9593d39e060583cc908b904a5ad0e738b531560846d5ac7815cad8c1c57cb346a8131fb2709d808ae75d5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads